{
 "id": "WPSEC-2026-2809",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2809/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2809/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2809/index.md",
 "title": "Advanced Custom Fields: Font Awesome Field <= 6.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Font Awesome Icon Field Value",
 "description": "The Advanced Custom Fields: Font Awesome Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Font Awesome icon field value in all versions up to, and including, 6.2.0, due to insufficient input sanitization and output escaping of the user-supplied icon JSON (such as the unicode, id, style, family, path and SVG html properties, as well as legacy class strings) when it is saved and formatted, particularly through the 'Icon Object' and 'Unicode' return formats. This makes it possible for authenticated attackers who can save a Font Awesome icon field, with Subscriber-level access and above where such a field is shown on the user profile form, or Contributor-level access and above where it is attached to posts, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the icon.",
 "plugin": {
  "slug": "advanced-custom-fields-font-awesome",
  "name": "Advanced Custom Fields: Font Awesome Field",
  "full_name": "Advanced Custom Fields: Font Awesome Field",
  "wordpress_org": "https://wordpress.org/plugins/advanced-custom-fields-font-awesome/",
  "advisories_url": "https://wpsec.com/vuln/plugin/advanced-custom-fields-font-awesome/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/advanced-custom-fields-font-awesome"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.0.0",
    "from_inclusive": true,
    "to": "6.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.0.0 before 6.2.1"
  ]
 },
 "introduced_in": "4.0.0",
 "fixed_in": "6.2.1",
 "remediation": "Update to 6.2.1 or later.",
 "fix_released": "2026-11-09T13:09:37+00:00",
 "published": "2026-11-10T13:45:29+00:00",
 "updated": "2026-11-09T23:34:22.272326+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2809/",
  "https://plugins.svn.wordpress.org/advanced-custom-fields-font-awesome/tags/6.2.1/",
  "https://wordpress.org/plugins/advanced-custom-fields-font-awesome/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/advanced-custom-fields-font-awesome",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}